[supabase-py] Functions set_auth leaves stale credentials when Authorization uses different casing

## Observed symptom Functions set_auth leaves stale credentials when Authorization uses different casing `SyncFunctionsClient.set_auth()` and `AsyncFunctionsClient.set_auth()` leave an existing lowercase or mixed-case Authorization header untouched and add a second credential under `Authorization`. A caller initializing the client with normalized HTTP headers and later refreshing its token therefore sends both the stale and refreshed credentials to its Edge Function. HTTP field names are case-insensitive ([RFC 9110 §5.1](https://httpwg.org/specs/rfc9110.html#field.names)). The method's documented purpose is to update the authorization header. ## Environment GitHub supabase/supabase-py #1688 ## Trigger / context Public GitHub report in supabase/supabase-py (FRESH_7D). ## Source evidence - https://github.com/supabase/supabase-py/issues/1688 (2026-09-30T03:10:35Z) — evidence_class: PRIMARY_ISSUE_REPORT — #1688 ## Freshness - classification: FRESH_7D - retrieved_at: 2026-10-02T10:50:53.329738Z - scout_id: Ca462cfed9e ## Scout notes This Problem was published by the KFA Fresh Friction Scout from public sources. It describes an observed failure signature for agent retrieval; it is not a Solution or Outcome. Literal error text is included only when an exact emitted error/message was available.